Certificate used for digitally signing malware.

Hunt Hypothesis

This detection identifies adversaries leveraging valid digital certificates to sign malicious executables, a tactic designed to bypass signature-based security controls and establish trust with endpoints. Proactively hunting for this behavior in Azure Sentinel is critical because attackers increasingly abuse legitimate certificate authorities to evade traditional antivirus solutions, necessitating deeper analysis of signing entities beyond simple validity checks.

YARA Rule

rule cert_blocklist_06a164ec5978497741ee6cec9966871b {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "JOHN WILLIAM RICHARD" and
            pe.signatures[i].serial == "06:a1:64:ec:59:78:49:77:41:ee:6c:ec:99:66:87:1b" and
            1385596799 <= pe.signatures[i].not_after
        )
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Certificate used for digitally signing malware,” along with suggested filters and exclusions:

• Scenario: Automated Patch Deployment via Windows Update or SCCM

  • Context: Enterprise patch management tools (e.g., Microsoft Endpoint Configuration Manager, WSUS) frequently download and install updates using certificates that are also known to sign legitimate software. If a specific vendor’s certificate has been compromised in the past or is widely used across both benign and malicious ecosystems, the initial installation of a new patch might trigger this rule.
  • Filter/Exclusion: Exclude processes with ImageName matching *wuauserv.exe, *ccmsetup.exe, or *UpdateOrchestrator.exe. Additionally, filter out events where the SourcePort corresponds to known internal patch servers (e.g., ports 8530-8531 for SCCM).

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Endpoint protection suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection run scheduled jobs to download and apply new definition signatures. These updates are digitally signed by the vendor’s root CA. If that specific certificate has been flagged in threat intelligence feeds as “used for signing malware” (due to a past incident involving a different product from the same vendor), legitimate definition updates will generate alerts.
  • Filter/Exclusion: Create an exclusion based on CommandLine containing keywords like *update.exe, *falcon.sys, or *mpcmdrun.exe. Further refine by excluding events where the ParentImageName is a known AV service process (e.g., C:\Program Files\Microsoft Defender\MsMpEng.exe).

• Scenario: CI/CD Pipeline Artifact Deployment

  • Context: In DevOps environments, tools